For businesses large and small, relying on a cloud-based collaboration and productivity suite such as Microsoft Office 365 is becoming the norm. Enhancing productivity in your organisation is vital to get ahead in 2017 - and using Office 365 can help, if it's used right...

Banks urged to change security policies

Basic questions too easy to circumvent, warns Symantec

Basic security questions, such as asking for a user's mother's maiden name or
post code, can be circumvented far too easily and should not be used, according
to Symantec.

The security firm said that this type of information is often readily
available online and easy accessible through a few quick searches, and that
these types of questions are no longer enough to confirm an identity.

"All you need to steal someone's identity can be obtained simply by looking
at the Census data," said Guy Bunker, chief scientist at Symantec.

"Bank and credit card companies use information such as mother's maiden name
as a standard security question, but it's no longer enough. They have to look at
other ways to prove that you are who you say you are."

Bunker reckons that, although a lot of work has been done to improve security
when accessing accounts online, telephone banking is wide open to abuse.

Operators who need to confirm a customer's identity should be seeking more
random information, or asking for individual characters from a predefined
pass-phrase, thereby mitigating the risk if someone overhears the conversation.

"Banks must start asking questions that no one else can find the information
for. First pet's name or favourite film would be fine, as long as the answers to
these aren't published on a social networking site. The ideal scenario would be
for people to choose their own questions," he said.

Symantec's recent
Underground
Economy Report (PDF) found that full identities are the third most common
specific item requested by online criminals, accounting for nine per cent of the
requested total.

Full identities are very popular with fraudsters as it makes it easier to
access existing accounts, and allows them to create new accounts in the victim's
name, potentially giving them access to a much larger payout and extending the
time until the fraud is detected.

To help combat this type of fraud, some financial institutions have
implemented other authentication technologies, including voice identification,
to help verify the caller's identity.

"Confidence in the banking system in the UK is at an all-time low. It is time
banks took responsibility for ensuring the security of their customers online
and over the phone," concluded Bunker.